CVE-2020-14330
First published: Fri Sep 11 2020(Updated: )
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ansible Engine | <2.9.12 | |
| Debian Debian Linux | =10.0 | |
| debian/ansible | 2.7.7+dfsg-1+deb10u1 2.7.7+dfsg-1+deb10u2 2.10.7+merged+base+2.10.8+dfsg-1 7.3.0+dfsg-1 7.7.0+dfsg-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330
- https://github.com/ansible/ansible/issues/68400
- https://www.debian.org/security/2021/dsa-4950
- https://github.com/ansible/ansible/pull/69653
- https://github.com/ansible/ansible/pull/70762
- https://github.com/ansible/ansible/commit/e0f25a2b1f9e6c21f751ba0ed2dc2eee2152983e
- https://github.com/ansible/ansible/commit/76815d3afccc7baffa196456d092f4de94b4fbb1
- https://security-tracker.debian.org/tracker/CVE-2020-14330
Frequently Asked Questions
What is CVE-2020-14330?
CVE-2020-14330 is an Improper Output Neutralization for Logs flaw in Ansible.
What is the severity of CVE-2020-14330?
The severity of CVE-2020-14330 is medium with a CVSS score of 5.5.
How does CVE-2020-14330 affect Ansible?
CVE-2020-14330 affects Ansible when using the uri module, exposing sensitive data to content and json output.
What are the affected software versions for CVE-2020-14330?
The affected software versions for CVE-2020-14330 include Ansible Engine up to version 2.9.12 and Debian Linux version 10.0.
How can I fix CVE-2020-14330?
To fix CVE-2020-14330, update Ansible to version 2.7.7+dfsg-1+deb10u1, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, or 7.7.0+dfsg-3.
- collector/nvd-index
- collector/security-tracker-debian
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- vendor/redhat
- canonical/redhat ansible engine
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- package-manager/debian